2020 CVEs (page 69)
Page 69 of 194 — CVEs published in 2020, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7570 | Medium | 5.4 | 2020-11-19 | A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebRe… |
CVE-2020-7569 | High | 8.8 | 2020-11-19 | A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an aut… |
CVE-2020-7568 | Medium | 4.3 | 2020-11-19 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) that could allow non… |
CVE-2020-7567 | Medium | 5.7 | 2020-11-19 | A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to find the p… |
CVE-2020-7566 | High | 7.3 | 2020-11-19 | A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encrypti… |
CVE-2020-7565 | High | 7.3 | 2020-11-19 | A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryp… |
CVE-2020-7561 | Critical | 9.8 | 2020-11-19 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T300 (with firmware 2.7 and older) that could cause a wide range of pro… |
CVE-2020-7559 | High | 7.5 | 2020-11-19 | A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Uni… |
CVE-2020-7558 | High | 7.8 | 2020-11-19 | A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF… |
CVE-2020-7557 | High | 7.8 | 2020-11-19 | A CWE-125 Out-of-bounds Read vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (… |
CVE-2020-7556 | High | 7.8 | 2020-11-19 | A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF… |
CVE-2020-7555 | High | 7.8 | 2020-11-19 | A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF… |
CVE-2020-7554 | High | 7.8 | 2020-11-19 | A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that c… |
CVE-2020-7553 | High | 7.8 | 2020-11-19 | A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF… |
CVE-2020-7552 | High | 7.8 | 2020-11-19 | A CWE-787: Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247, that could cause Remote Code Execution when malicious CG… |
CVE-2020-7551 | High | 7.8 | 2020-11-19 | A CWE-787: Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247, that could cause Remote Code Execution when malicious CG… |
CVE-2020-7550 | High | 7.8 | 2020-11-19 | A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 and pr… |
CVE-2020-7544 | High | 7.8 | 2020-11-19 | A CWE-269 Improper Privilege Management vulnerability exists in EcoStruxureª Operator Terminal Expert runtime (Vijeo XD) that could cause privilege escalation… |
CVE-2020-7538 | High | 7.5 | 2020-11-19 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versi… |
CVE-2020-28954 | Medium | 5.3 | 2020-11-19 | web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a… |
CVE-2020-28953 | Medium | 4.3 | 2020-11-19 | In BigBlueButton before 2.2.29, a user can vote more than once in a single poll. |
CVE-2020-28213 | High | 8.8 | 2020-11-19 | A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that co… |
CVE-2020-28212 | Critical | 9.8 | 2020-11-19 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all… |
CVE-2020-28211 | High | 7.8 | 2020-11-19 | A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause bypass… |
CVE-2020-28209 | High | 7.0 | 2020-11-19 | A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central in… |
CVE-2020-28350 | Medium | 6.1 | 2020-11-19 | A Cross Site Scripting (XSS) vulnerability exists in OPAC in Sokrates SOWA SowaSQL through 5.6.1 via the sowacgi.php typ parameter. |
CVE-2020-28210 | Medium | 6.1 | 2020-11-19 | A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V… |
CVE-2020-25989 | High | 7.8 | 2020-11-19 | Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an att… |
CVE-2020-28924 | High | 7.5 | 2020-11-19 | An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords wit… |
CVE-2020-28951 | Critical | 9.8 | 2020-11-19 | libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names. This is related to uci_parse_packag… |
CVE-2020-28949 | High | 7.8 | 2020-11-19 | Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite f… |
CVE-2020-28948 | High | 7.8 | 2020-11-19 | Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. |
CVE-2020-28941 | Medium | 5.5 | 2020-11-19 | An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver coul… |
CVE-2020-28947 | Medium | 6.1 | 2020-11-19 | In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled. |
CVE-2020-22394 | Medium | 6.1 | 2020-11-19 | In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. |
CVE-2020-12510 | High | 7.3 | 2020-11-19 | The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirec… |
CVE-2020-12496 | Medium | 6.5 | 2020-11-19 | Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) and Memograph M (Neutral/Private Label) (RSG45, ORSG45) with Firmware version V2.0.0 and abov… |
CVE-2020-12495 | Critical | 9.1 | 2020-11-19 | Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected… |
CVE-2020-6879 | Low | 3.5 | 2020-11-19 | Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of t… |
CVE-2020-28942 | Medium | 4.3 | 2020-11-19 | An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protocol. As a part of EJBCA's domain securit… |
CVE-2020-25703 | Medium | 5.3 | 2020-11-19 | The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 t… |
CVE-2020-25702 | Medium | 6.1 | 2020-11-19 | In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10. |
CVE-2020-25701 | Medium | 5.3 | 2020-11-19 | If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable t… |
CVE-2020-25700 | Medium | 6.5 | 2020-11-19 | In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8… |
CVE-2020-25699 | High | 7.5 | 2020-11-19 | In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Ve… |
CVE-2020-25698 | High | 7.5 | 2020-11-19 | Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrollin… |
CVE-2020-9049 | High | 7.1 | 2020-11-19 | A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on th… |
CVE-2020-4718 | Medium | 5.4 | 2020-11-19 | IBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary Java… |
CVE-2020-4701 | High | 7.8 | 2020-11-19 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking w… |
CVE-2020-28054 | High | 7.5 | 2020-11-19 | JamoDat TSMManager Collector version up to 6.5.0.21 is vulnerable to an Authorization Bypass because the Collector component is not properly validating an auth… |
CVE-2020-11831 | Critical | 9.8 | 2020-11-19 | OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1. |
CVE-2020-11830 | Critical | 9.8 | 2020-11-19 | QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0. |
CVE-2020-11829 | Critical | 9.8 | 2020-11-19 | Dynamic loading of services in the backup and restore SDK leads to elevated privileges, affected product is com.coloros.codebook V2.0.0_5493e40_200722. |
CVE-2020-15710 | Medium | 5.3 | 2020-11-19 | Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable may be freed twice… |
CVE-2020-8279 | High | 7.4 | 2020-11-19 | Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack. |
CVE-2020-8278 | Medium | 5.3 | 2020-11-19 | Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user. |
CVE-2020-8277 | High | 7.5 | 2020-11-19 | A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14… |
CVE-2020-5947 | Medium | 4.3 | 2020-11-19 | In versions 16.0.0-16.0.0.1 and 15.1.0-15.1.1, on specific BIG-IP platforms, attackers may be able to obtain TCP sequence numbers from the BIG-IP system that c… |
CVE-2020-13359 | High | 7.6 | 2020-11-19 | The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the… |
CVE-2020-13356 | High | 8.2 | 2020-11-19 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request could bypass Multipart protection and read… |
CVE-2020-13355 | High | 7.5 | 2020-11-19 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwri… |
CVE-2020-12593 | High | 7.5 | 2020-11-18 | Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a type of vulnerability that could potent… |
CVE-2020-26226 | High | 8.1 | 2020-11-18 | In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they co… |
CVE-2020-26215 | Medium | 4.4 | 2020-11-18 | Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a diffe… |
CVE-2020-22723 | Medium | 6.1 | 2020-11-18 | A cross-site scripting (XSS) vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers to inject arbitrary… |
CVE-2020-15300 | Medium | 6.1 | 2020-11-18 | SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document. |
CVE-2020-14208 | Medium | 5.4 | 2020-11-18 | SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated a… |
CVE-2020-13799 | Medium | 6.8 | 2020-11-18 | Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specified in multiple standards for storage dev… |
CVE-2020-25454 | Medium | 5.4 | 2020-11-18 | Cross-site Scripting (XSS) vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe. |
CVE-2020-15301 | High | 7.8 | 2020-11-18 | SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. These fields are mishandled… |
CVE-2020-3586 | Critical | 9.4 | 2020-11-18 | A vulnerability in the web-based management interface of Cisco DNA Spaces Connector could allow an unauthenticated, remote attacker to execute arbitrary comman… |
CVE-2020-3531 | Critical | 9.8 | 2020-11-18 | A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to access the back-end database of an… |
CVE-2020-3482 | Medium | 6.5 | 2020-11-18 | A vulnerability in the Traversal Using Relays around NAT (TURN) server component of Cisco Expressway software could allow an unauthenticated, remote attacker t… |
CVE-2020-3471 | Medium | 6.5 | 2020-11-18 | A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to maintain bidirectional audio despite… |
CVE-2020-3470 | Critical | 9.8 | 2020-11-18 | Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to execute arbitr… |
CVE-2020-3441 | Medium | 5.3 | 2020-11-18 | A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to view sensitive information from the… |
CVE-2020-3419 | Medium | 6.5 | 2020-11-18 | A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to join a Webex session without appeari… |
CVE-2020-28581 | High | 7.2 | 2020-11-18 | A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attack… |
CVE-2020-28580 | High | 7.2 | 2020-11-18 | A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker… |
CVE-2020-28579 | High | 8.8 | 2020-11-18 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP… |
CVE-2020-28578 | Critical | 9.8 | 2020-11-18 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTT… |
CVE-2020-28574 | High | 7.5 | 2020-11-18 | A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow an unauthenticated… |
CVE-2020-28572 | High | 7.8 | 2020-11-18 | A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additional malicious code i… |
CVE-2020-27697 | High | 7.8 | 2020-11-18 | Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected lo… |
CVE-2020-27696 | High | 7.8 | 2020-11-18 | Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory w… |
CVE-2020-27695 | High | 7.8 | 2020-11-18 | Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory… |
CVE-2020-4592 | Medium | 6.5 | 2020-11-18 | IBM MQ Appliance 9.1.CD and LTS could allow an authenticated user, under nondefault configuration to cause a data corruption attack due to an error when using… |
CVE-2020-3392 | High | 7.5 | 2020-11-18 | A vulnerability in the API of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive information on an affect… |
CVE-2020-3367 | High | 7.8 | 2020-11-18 | A vulnerability in the log subscription subsystem of Cisco AsyncOS for the Cisco Secure Web Appliance (formerly Web Security Appliance) could allow an authenti… |
CVE-2020-27126 | Medium | 6.1 | 2020-11-18 | A vulnerability in an API of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is… |
CVE-2020-26097 | Critical | 9.8 | 2020-11-18 | The firmware of the PLANET Technology Corp NVR-915 and NVR-1615 before 2020-10-28 embeds default credentials for root access via telnet. By exposing telnet on… |
CVE-2020-26081 | Medium | 6.1 | 2020-11-18 | Multiple vulnerabilities in the web UI of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to conduct cross-site scriptin… |
CVE-2020-26080 | Medium | 4.1 | 2020-11-18 | A vulnerability in the user management functionality of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to manage user inf… |
CVE-2020-26079 | Medium | 4.9 | 2020-11-18 | A vulnerability in the web UI of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to obtain hashes of user passwords on an… |
CVE-2020-26078 | Medium | 6.5 | 2020-11-18 | A vulnerability in the file system of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to overwrite files on an affected sy… |
CVE-2020-26077 | Medium | 4.3 | 2020-11-18 | A vulnerability in the access control functionality of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to view lists of us… |
CVE-2020-26076 | High | 7.5 | 2020-11-18 | A vulnerability in Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive database information on an affected… |
CVE-2020-26075 | High | 8.8 | 2020-11-18 | A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to gain access to the back-end database… |
CVE-2020-26072 | High | 8.7 | 2020-11-18 | A vulnerability in the SOAP API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to access and modify information on dev… |
CVE-2020-26068 | Medium | 5.5 | 2020-11-18 | A vulnerability in the xAPI service of Cisco Telepresence CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to generate an ac… |